What’s Vulnerable › Products

YunaiV yudao-cloud vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your YunaiV yudao-cloud version is affected

Latest YunaiV yudao-cloud vulnerabilities

• CVE-2026-116016 — yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header (CVSS 7.1)
• CVE-2026-116015 — yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint (CVSS 4.3)
• CVE-2026-58448 — yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API (CVSS 6.5)
• CVE-2026-9464 — YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery (CVSS 4.7)
• CVE-2026-7710 — YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication (CVSS 7.3)
• CVE-2026-7679 — YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication (CVSS 7.3)
• CVE-2026-7678 — YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection (CVSS 6.3)
• CVE-2026-5148 — YunaiV yudao-cloud page sql injection (CVSS 4.7)
• CVE-2026-5147 — YunaiV yudao-cloud get-by-website sql injection (CVSS 7.3)
• CVE-2025-15098 — YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery (CVSS 6.3)
• CVE-2025-10987 — YunaiV yudao-cloud HTTP Request transfer improper authorization (CVSS 8.8)
• CVE-2025-10277 — YunaiV yudao-cloud submit improper authorization (CVSS 8.8)
• CVE-2025-10275 — YunaiV yudao-cloud transfer improper authorization (CVSS 8.8)